The vulnerability resides in the Elated Membership WordPress plugin, specifically in versions 1.2 or earlier. The plugin’s social login functions, 'eltdf_membership_check_facebook_user' and 'eltdf_membership_login_user_from_social_network', fail to complete the authentication handshake after previous validation. As a result, an attacker who can create a temporary user account and knows the target administrator’s email can trigger the social login flow and be logged in as that administrator without any password. This bypass enables full administrative control over the site, including configuration changes, user management, and potential malware installation, thereby compromising confidentiality, integrity, and availability.

Vulnerable instances of the Elated Membership plugin for WordPress, used on any WordPress site that has the plugin installed in a version equal to or older than 1.2. The problem affects all sites that enable the temporary user creation feature and allow social login via Facebook.

The CVSS score of 9.8 indicates critical severity, and the EPSS score of less than 1% suggests that active exploitation is currently rare, though the low probability does not diminish the potential damage. The vulnerability is not listed in the CISA KEV catalog, but the impact level remains high. It is inferred that attackers can reach the flaw remotely via the public-facing social login endpoint, making the attack vector network-based. Successful exploitation requires that the attacker can create a temporary user on the target site and obtain the victim administrator’s email address, after which the authentication bypass grants full administrative privileges.